← Back to Daily Builds

Daily build note · October 28, 2026

Tune-Up

Check 30 launch-risk items across secrets, auth, database rules, AI spend, payments and more for an AI-built app to get a health score and grade, per-category gauges, and a prioritized service ticket of fixes with plain-English explanations and estimated fix times.

AI Tools Interactive demo live Static HTML/CSS/JS

What shipped

Tune-Up is a quick-lube style health check for vibe-coded apps. Pick a stack (Lovable/Bolt/v0 + Supabase, Next.js + Supabase, Firebase, Bubble/no-code, a custom API, or an AI chatbot wrapper), switch on what the app does (accounts, payments, paid AI calls, personal data, public launch), then answer 30 checks with Yes, Not sure or No. Checks span 12 areas: secrets and keys in the client, auth and access rules, database rules and RLS, input validation, error handling and logging, backups, rate limits and AI/API cost runaway, payments and webhooks, deploy and env config, dependencies, performance, and analytics and monitoring. Checks that don't apply are marked N/A, and the profile changes how much each area counts. You get a 0-100 health score, a letter grade (any unresolved critical item caps it at D), a stamp verdict (CLEARED FOR LAUNCH, SERVICE RECOMMENDED or DO NOT DRIVE), 12 category gauges, and a service ticket of fixes grouped CRITICAL (before launch), SOON (first week) and LATER, each with why it matters, the fix, an estimated time and a shop-time total. There's a markdown report stamped in Central time, and state saves under tune-up-v1.

How to try

  • The demo opens on Weekend Lovable/Bolt MVP: 14/100, grade F, DO NOT DRIVE, with 5 critical faults, including a service-role key shipped in the frontend and Supabase tables without RLS.
  • Load AI chatbot wrapper with OpenAI key (21, F) to see the cost-runaway items light up: the key sits in the browser, there's no per-user rate limit and no spend cap.
  • Supabase SaaS with Stripe scores 74 but is capped at D by one critical gap (policies not scoped to the signed-in user). Internal tool marks 15 checks N/A and lands at C. Polished launch-ready app is 100/A.
  • Flip any answer and the score, gauges and ticket update right away. Then hit Copy markdown report to paste the ticket into an issue or a client email.

Why this (vs neighbors)

This comes from the Startup Opportunities list ("Jiffy Lube for vibe coded apps": quick fixes when your AI-built app breaks). Before you can sell the fix, you need a fast, honest intake that a non-engineer founder can fill out in five minutes, and a ticket that turns into scoped work. Earlier builds like Change Preflight check a single change before it ships. Tune-Up checks a whole app before launch.

Scope trim

No code scanning, no repo or Supabase connection, no automated tests, and no pricing for the fixes. The answers are self-reported.

Limitations

  • This is a rough triage checklist, not a security audit or penetration test. A good score doesn't mean the app is safe.
  • Weights, severities and fix-time estimates are rough judgment calls that will vary by stack and team.
  • "Not sure" is scored as mostly risky on purpose, so a lot of unknowns will pull the grade down.

Suggested next steps

  1. Add a read-only scanner that checks a deployed URL's JS bundle for leaked keys and a Supabase project for tables without RLS.
  2. Turn the service ticket into a fixed-price quote (fix time x rate) with a "book a tune-up" button.
  3. Add stack-specific fix snippets (Supabase policies, Stripe webhook verification, an OpenAI proxy route).